textavia-json-tools
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'textavia' package from the NPM registry to provide the necessary CLI tools. This is the official package from the skill author, Caravaca Labs.
- [COMMAND_EXECUTION]: Executes shell commands using the 'txv' and 'textavia' binaries to perform JSON operations such as formatting, minification, and conversion.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructions explicitly direct the agent to process data locally and avoid uploading sensitive information to remote services.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data from files or user input. While this presents an ingestion surface for indirect instructions, the skill uses these inputs strictly as data for formatting or conversion by a local binary, which mitigates the risk of the agent obeying embedded commands.
- Ingestion points: Processes JSON data via CLI arguments and local files (e.g., data.json, users.json).
- Boundary markers: No explicit delimiters are specified for the CLI inputs.
- Capability inventory: Access to the terminal toolset for executing 'txv' commands.
- Sanitization: Relies on the 'textavia' CLI tool to parse and validate the JSON structure before processing.
Audit Metadata